Za darmo · bez rejestracji · bez limitu czasu
Gotowe quizy z pytaniami zamkniętymi, sprawdzone ręcznie. Rozwiąż dowolny darmowy quiz online — każda odpowiedź ma wyjaśnienie, a każdy quiz pełny klucz odpowiedzi do powtórki.
Wczytywanie quizów
Za darmo · bez rejestracji · bez limitu czasu
Gotowe quizy z pytaniami zamkniętymi, sprawdzone ręcznie. Rozwiąż dowolny darmowy quiz online — każda odpowiedź ma wyjaśnienie, a każdy quiz pełny klucz odpowiedzi do powtórki.
IT
Test your expertise in modern application security, OWASP Top 10 vulnerabilities, secure session management, and cryptographic implementations. Odpowiadaj na pytania i od razu sprawdzaj, czy to dobra odpowiedź — zawsze z wyjaśnieniem.
Darmowy test próbny z 16 pytaniami zamkniętymi z kategorii IT. Każde pytanie ma jedną poprawną odpowiedź i krótkie wyjaśnienie, a pełny klucz odpowiedzi pod quizem służy jako ściąga do nauki. Bez konta, bez limitu czasu — rozwiązuj, ile chcesz.
To darmowy quiz z 16 pytaniami zamkniętymi. Po każdej odpowiedzi zobaczysz, czy była poprawna, razem z wyjaśnieniem. Bez rejestracji i bez limitu czasu — rozwiązuj go, ile razy chcesz, a klucz odpowiedzi powyżej wykorzystaj do powtórki przed quizem albo po nim.
Poprawna odpowiedź: BIt tricks the victim's browser into sending unauthorized HTTP requests along with ambient credentials (like cookies) to a target site
CSRF exploits the trust a site places in a user's browser by having an untrusted site trick the user into executing unwanted actions where they are already authenticated.
Poprawna odpowiedź: BSetting the HttpOnly flag on the cookie
The HttpOnly flag prevents client-side scripts (such as those injected via XSS) from reading document.cookie, mitigating session-hijacking attacks.
Poprawna odpowiedź: BSymmetric uses the same secret key for encryption and decryption; asymmetric uses mathematically paired public and private keys
Symmetric cryptography (AES, ChaCha20) uses a shared secret key for encryption and decryption, while asymmetric cryptography (RSA, ECC) uses public/private key pairs.
Poprawna odpowiedź: CArgon2id
Argon2id (the winner of the Password Hashing Competition) requires configurable compute time and memory allocations, resisting parallel GPU and ASIC attacks.
Poprawna odpowiedź: BIt allows a server to declare which external web origins are permitted to read its HTTP responses via the browser
CORS is a browser security mechanism that relaxes the Same-Origin Policy, allowing servers to specify via headers which external origins can access their resources.
Poprawna odpowiedź: BIt abuses an application feature to force the vulnerable backend server to send crafted requests to internal, unexposed network resources
SSRF allows an attacker to manipulate server functionality to make outbound requests to unintended targets, often reaching internal services (like cloud metadata APIs at 169.254.169.254).
Poprawna odpowiedź: BThey separate SQL query code from user-supplied parameters, ensuring inputs are treated strictly as literal data rather than executable code
Prepared statements pre-compile the SQL template on the database server; parameter values are bound separately and treated strictly as literal data, preventing injection.
Poprawna odpowiedź: BThe token contains no cryptographic signature, allowing an attacker to modify claims (like user ID or roles) without detection
If a server improperly allows the 'none' algorithm, attackers can alter the payload (e.g., setting 'admin': true) and submit the token unsigned, bypassing authentication.
Poprawna odpowiedź: BTo instruct the browser to restrict the sources from which scripts, stylesheets, and images can be loaded and executed
A CSP restricts the domains and mechanisms from which scripts, styles, and other assets can load, mitigating Cross-Site Scripting (XSS) and data injection.
Poprawna odpowiedź: BRemote Code Execution (RCE) via arbitrary gadget chains executed during object reconstruction
Insecure deserialization of untrusted data can trigger gadget chains—sequences of existing classes that execute arbitrary commands or code during object instantiation.
Poprawna odpowiedź: BOAuth 2.0 is an authorization framework (access delegation); OpenID Connect is an identity layer built on top of OAuth 2.0 for user authentication
OAuth 2.0 delegates resource access authorization (via Access Tokens); OpenID Connect builds on OAuth 2.0 to add verified identity and authentication (via ID Tokens).
Poprawna odpowiedź: BA vulnerability where an application uses user-supplied input to access database objects directly without verifying access authorization
IDOR happens when an app exposes internal identifiers (like /orders/1234) without validating that the authenticated user owns or has permission to access that specific resource.
Poprawna odpowiedź: BIt instructs the browser never to send the cookie in cross-site requests, effectively neutralizing CSRF attacks from external links
SameSite=Strict prevents the browser from sending the cookie in any cross-site browsing context (even ordinary incoming links), neutralizing cross-site request forgery.
Poprawna odpowiedź: BTo check whether an issued X.509 digital certificate has been invalidated or compromised prior to its scheduled expiration
CRLs and Online Certificate Status Protocol (OCSP) allow clients to verify whether a certificate authority has revoked a certificate before its formal expiration date.
Poprawna odpowiedź: BIntercepting valid authentication data or network transmissions and fraudulently retransmitting them to repeat authorized actions
A replay attack captures valid network transmissions (like signed requests or tokens) and re-sends them to trick the receiver into executing duplicate unauthorized operations.
Poprawna odpowiedź: BAttacks where third-party hosted script dependencies (e.g., CDN-hosted libraries) are compromised and altered with malicious code
SRI checks the cryptographic hash of scripts loaded from third-party CDNs; if an attacker tampers with the CDN asset, the browser hash check fails and refuses execution.